3

I'm trying to setup SSL on my AWS ELB, but I am thus far unable to figure out what goes into the "Certificate Chain" field. I receive the following error:

Unable to validate certificate chain. The certificate chain must start with the immediate signing certificate, followed by any intermediaries in order. The index within the chain of the invalid certificate is: -1

I have my private key & certificate in PEM format and uploaded. If I use these without the "optional" chain, it works untrusted. I have been poking around, trying to find an answer on what to put into the field, and this answer suggests downloading the gd_bundle-g2.crt - I have done this and converted it into PEM by running openssl x509 -inform PEM -in gd_bundle-g2.crt but the error remains. When I downloaded my certificate from GoDaddy, I was given a ZIP with my SSL certificate along with gdig2.crt and gd_bundle-g2-g1.crt. I have tried using these files in various combinations, and alone, but again, nothing.

What certificates go into the Certificate Chain, in what order, and in what format?

Improve this question

3 Answers 3

Reset to default
7

So the problem was several mistakes along the way for me. First, I took the -----BEGIN CERTIFICATE----- section from the PEM generated from my keytool keystore. Second, I was trying to convert the gd_bundle-g2-g1.crt file - it already contained exactly what I needed to use.

To start from the beginning - I used Digicert's Java Keytool to generate my commands to get my keystore and CSR using keytool. From there, I got a wildcard SSL certificate through GoDaddy and downloaded my certificate which was in a ZIP file along with gdig.crt and gd_bundle-g2-g1.crt. After this, I follwed to steps to get the private key from my keystore following this StackOverflow answer. However, the foo.pem file from this command required one more command, openssl rsa -in foo.pem -out foo.rsa to get the final form accepted by the AWS panel.

Now to fill in the SSL form on AWS:

  • Private Key: The contents of the foo.rsa file from the previous step.
  • Public Key Certificate: The contents of the <your_cert>.crt file provided by GoDaddy
  • Certificate Chain: The contents of the gd_bundle-g2-g1.crt file provided by GoDaddy

This has given me a successful SSL certificate setup for my AWS ELB, with the proper certificate path, giving me a trusted certificate.

Improve this answer
3
  • Thanks, wasn't sure what to use as the chain in amazon , simply put the text from the crt file as you said and it worked .
    – John
    Jul 10, 2015 at 7:54
  • Yep, gd_bundle-g2-g1.crt works for me
    – Nick Howard
    Jan 24, 2016 at 10:05
  • goddady gd_bundle-g2-g1.crt certs can be found here certs.godaddy.com/repository
    – equivalent8
    Apr 12, 2021 at 16:11
1

It's not a trivial process, and the documentation isn't great.

This version of the process using Gandi.net SSL certificates might help you work though it, it's much better than the official docs

http://lexical.scopely.com/2015/03/11/uploading-an-ssl-cert-from-gandi-net-to-iam/

Improve this answer
2
  • Thought not directly helpful, it gave me some ideas to try that led me to the correct answer. Thanks for the links!
    – user276790
    Mar 17, 2015 at 19:46
  • This is a link-only answer. Please include the relevant parts in the answer here.
    – mikemaccana
    May 17, 2017 at 12:14
0

It is important to note that the intermediate certificates are not specific to your domain or certificate. So, every certificate issued that is like yours, has the exact same intermediate certificates.

You can think of them a bit like the routing number on your checks. The routing number is needed, but really says more about your bank than it does about you. Your account number, or your certificate in this case, is what is unique to you.

Because of the generic nature of the intermediate certificates there are websites like this one:

https://www.ssl2buy.com/wiki/ssl-intermediate-and-root-ca-bundle

That have all of the intermediate certificates pre-bundled (and in the correct order) for different certificate issuers.

Improve this answer

You must log in to answer this question.